Troubleshooting a mailbox that will not archive in Enterprise Vault
One of the most common questions asked by Enterprise Vault administrators on the Symantec Connect forums is: “Why does this mailbox not get archived?”. There are many different reasons why the mailbox may not be archiving, and in this article we'll go through several of them.
Finding out that a mailbox is not being archived is always something of a challenge. You can of course review the Exchange Mailbox Archiving Reports, but they might only give you part of the picture. Usually finding out involves the user, perhaps sometime after the 'problem' started happening, contacting the help desk and raising a ticket for what is perceived as items which aren't getting archived when they should.
Simply a change in policy
Users aren't necessarily the greatest at determining why some items are not being archived, when they believe that they should be. Often a user will be used to certain items, or folders being archived, and then because a policy has changed server side the items aren't any longer eligible, or take longer to become eligible. So a simple change in policy could lead to an end-user contacting the help desk and reporting an issue which is in fact a non-issue, at least as far as the server or configuration goes.
For these types of things it is always worth while when changing policies that will affect end-users to firstly communicate the change to end-users, and secondly ensure that the help desk is sufficiently capable of diagnosing this as the source of the end-user 'problem'. That too involves communication, perhaps at a much deeper level then to end-users.
Disabled account or hidden mailbox?
The first real cause of items not being archived is to check if the users Active Directory account has been disabled. As we know Enterprise Vault by default does not archive mailboxes where the account is hidden. Likewise, the mailbox might be hidden from the Exchange Address Book. Just as with disabled accounts, hidden mailboxes by default aren't archived by Enterprise Vault.
It's possible to look at the ExchangeMailboxEntry in SQL to see what was found in terms of these two attributes, the last time the provisioning task ran. Better, of course, is to look at the properties of the account in Active Directory:
Check to see if it is disabled. To see if the account is hidden from the address book, then there are a couple of ways to see whether that is the situation. Firstly if you open Outlook with an online Outlook profile (rather than cached mode) you will also see the online address book. Secondly you could check the properties of the mailbox in Exchange Management Console:
Removed from provisioning group?
Sometimes users might be either deliberately or accidentally moved to a different provisioning group, which then affects what gets archived. Deliberately moving a user might be because they need to go into a different policy, for example you might have different provisioning groups for users with laptops versus desktops. A side effect thought might be that the new provisioning group has a slightly different archiving policy too, leaving items un-archived, when it's expected that they should be.
Accidentally moving provisioning groups is more common than you might think. Take for example provisioning which is based on end-users active directory group membership or even the Organizational Unit their account resides in. Should you remove them from a group, or add them to a different group then you may accidentally have also changed both their desktop policy and their mailbox archiving policy.
Disabled from EV archiving?
Sometimes a users mailbox will have been disabled from archiving, by an administrator. This can be seen in the mailbox archiving report to start with:
Sometimes this disabling from archiving will result in an end-user contacting the help desk to say that things don't appear to be being archived. For this situations the help desk needs a quick way to validate that the underlying issue is because the user has been disabled from archiving, and not some deeper configuration issue. One option here is to ensure that the mailbox archiving reports are available to help desk staff, or even have them emailed to a group mailbox each day.
User set 'Do Not Archive' at a high level?
If end-users use Microsoft Outlook, and they have the client set to 'full' rather than 'light', then they may have the option to change the archiving policy on particular folders. Either deliberately or accidentally they may have set a folder, at a high level, to be excluded from archiving, as can be seen here:
Of course they might have set that on the Inbox... which will usually affect a large amount of messages from being correctly archived, and worse they may have selected the root of the mailbox:
That effectively stops everything in the mailbox from being archived.
If you use the Mailbox Archiving Report and expand the details, you get information the number of folders marked as 'do not archive', which is very helpful!
Moved to a different mailbox server?
From time to time in a multiple mailbox server environment end-users might have their mailbox moved from one server to another. In some situations this can lead to the mailboxes not getting processed by an archiving task - for example maybe the target server doesn't even have an archiving task, or operates on a completely different schedule.
Wrong mix of policy settings?
Sometimes in a purely quota based archiving situation it might seem like items are not being archived, but really that might be perfectly normal. The mailbox could just simply be under the quota, and the related quota-based percentage in their associated policy. To check if that is the case we can do some rudimentary checks in SQL, or if you are also an Exchange administrator you can check on the Exchange side instead. I'll go with the SQL side, since an EV administrator might have access to SQL, but might not have access to Exchange.
So, first of all run this query...
Select * from ExchangeMailboxEntry where MbxDisplayname = 'ABC'
Secondly have a look at the policy that the user is touched by. It might be straight forward in your environment, with a small number of policies, but if you have a large number of policies the best way to find the right policy is as follows:
1. Open the Vault Admin Console
2. Navigate to the site level, then expand Targets
3. Right click on 'Exchange' and choose 'Display Policies Assigned to Mailboxes'
4. Enter a good filter to limit the result list, and do the search for the mailbox you are interested in
Now, the SQL query will show the current mailbox size, and the quotas imposed, and the policy will show the percentage that will mean the EV Archiving Task won't need to archive anything.
As you can see there are many different ways that a mailbox can end up being excluded or partially excluded from archiving. Some are not accidental, like moving users between Active Directory groups or Organizational Units, others might be more deliberate like users stopping archiving on top level folders in the mailbox.
Hopefully this article has given you an insight into many of the different causes for the issue of 'why isn't this mailbox being archived'. I'm sure that there are other obscure reasons too. Let me know if you have encountered these or other issues, in the comments...